CVE-2026-106437: CWE-191: Integer Underflow (Wrap or Wraparound) in MongoDB C Driver

The MongoDB C Driver's BSON buffer-reservation API can accept a length value smaller than the BSON minimum of five bytes. This causes unsigned integer underflow during later append or comparison operations, resulting in out-of-bounds memory access. An attacker who can influence the length parameter passed by the embedding application may cause the application to crash or corrupt adjacent memory. The vulnerability affects versions >=1.4.0 <1.30.13 and >=2.0.0 <2.5.6 of the MongoDB C Driver.

An attacker able to control the length parameter passed to bson_reserve_buffer can trigger out-of-bounds memory reads or writes, potentially causing application crashes or memory corruption. This could lead to denial of service or data integrity issues within the affected application. There is no indication of remote exploitability without local access or influence over the embedding application. No known exploits are reported in the wild.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should ensure that lengths passed to bson_reserve_buffer meet the BSON minimum size requirements and validate input lengths rigorously to prevent underflow conditions.